Cybercrime / Fraud Prevention

U.S. and Dutch Law Enforcement Agencies Dismantle BEC Fraud Network

Operation Heart Blocker

U.S. and Dutch law enforcement agencies have announced that they have dismantled 39 domains and their associated servers as part of efforts to disrupt a network of online marketplaces originating from Pakistan.

Background

The action, which took place on January 29, 2025, has been codenamed Operation Heart Blocker. The vast array of sites in question peddled phishing toolkits and fraud-enabling tools and was operated by a group known as Saim Raza since at least 2020, which is also known as HeartSender.

Tools and Services

The tools advertised on the marketplaces also made it possible to harvest victim user credentials, which were subsequently put to use to further the fraudulent schemes. Users can check if they are among those impacted by credential theft by visiting the URL "www.politie[.]nl/checkjehack" and entering their email addresses.

The Manipulaters

The cybercrime entity, also referred to as The Manipulaters, was first exposed by independent security journalist Brian Krebs in May 2015, with a report from DomainTools last year identifying operational security lapses indicating that several systems associated with the threat actors have been compromised by stealer malware.

Operation Heart Blocker

The development follows the takedown of online criminal marketplaces such as Cracked, Nulled, Sellix, and StarkRDP as part of a coordinated law enforcement operation dubbed Talent towards the end of January 2025.

Conclusion

The dismantling of the BEC fraud network is a significant step in disrupting the activities of transnational organized crime groups. The U.S. Department of Justice and Dutch police officials have worked together to take down the network and bring those responsible to justice.

Additional Resources

• Business Email Compromise (BEC) Attacks and Countermeasures
• The Resurgence of The Manipulaters Team Breaking HeartSenders
• The Manipulaters Improve Phishing Still Fail at Opsec